# Tests are EPEL only

%bcond_with tests

# No Python 3 by default

%bcond_with python3

%global srcname urllib3

Name:           python-%{srcname}

Version:        1.10.2

Release:        7%{?dist}

Summary:        Python HTTP library with thread-safe connection pooling and file post

License:        MIT

URL:            http://urllib3.readthedocs.org/

Source0:        https://pypi.python.org/packages/source/u/%{srcname}/%{srcname}-%{version}.tar.gz

# Patch to change default behaviour to check SSL certs for validity

# https://bugzilla.redhat.com/show_bug.cgi?id=855320

Patch0:         python-urllib3-default-ssl-cert-validate.patch

# Patch for the PoolManager instance to consider additional SSL

# configuration when providing a pooled connection for a request.

# https://bugzilla.redhat.com/show_bug.cgi?id=1329395

# Upstream issue: https://github.com/shazow/urllib3/pull/830

Patch1: key-connection-pools-off-custom-keys.patch

# Support IP address SAN fields.

# https://bugzilla.redhat.com/show_bug.cgi?id=1434114

# Upstream: https://github.com/shazow/urllib3/pull/922

Patch2: Add-support-for-IP-address-SAN-fields.patch

# Patch for CVE-2018-20060

# Cross-host redirect does not remove Authorization header allow

# for credential exposure

# Backported without tests!

# https://bugzilla.redhat.com/show_bug.cgi?id=1649153

# Upstream: https://github.com/urllib3/urllib3/pull/1346

Patch3: CVE-2018-20060.patch

# Patch for CVE-2019-9740

# CRLF injection due to not encoding the '\r\n' sequence leading to possible

# attack on internal service.

# https://github.com/urllib3/urllib3/pull/1591/commits/c147f359520cab339ec96b3ef96e471c0da261f6

# https://github.com/urllib3/urllib3/pull/1593/commits/e951dfc83a642b0b5239559cb1c8cc287481f1ae

# https://bugzilla.redhat.com/show_bug.cgi?id=1700824

Patch4: CVE-2019-9740.patch

BuildArch:      noarch

Requires:       ca-certificates

# Previously bundled things:

Requires:       python-six

Requires:       python-backports-ssl_match_hostname

Requires:       python-ipaddress

%if 0%{?rhel} <= 6

BuildRequires:  python-ordereddict

Requires:       python-ordereddict

%endif

BuildRequires:  python2-devel

BuildRequires:  python-setuptools

BuildRequires:  python-six

BuildRequires:  python-backports-ssl_match_hostname

BuildRequires:  python-ipaddress

# For unittests

%if %{with tests}

BuildRequires: python-nose

BuildRequires: python-tornado

BuildRequires: python-mock

%endif

%{?python_provide:%python_provide %{name}}

%description

Python HTTP module with connection pooling and file POST abilities.

%if %{with python3}

%package -n python3-%{srcname}

Summary:        Python 3 HTTP library with thread-safe connection pooling and file post

%{?python_provide:%python_provide python3-%{srcname}}

Requires:       ca-certificates

Requires:       python3-six

BuildRequires:  python3-devel

# For unittests

%if %{with tests}

BuildRequires:  python3-nose

BuildRequires:  python3-six

BuildRequires:  python3-tornado

BuildRequires:  python3-mock

%endif # with tests

%description -n python3-%{srcname}

Python3 HTTP module with connection pooling and file POST abilities.

%endif # with python3

%prep

%setup -q -n %{srcname}-%{version}

# Drop the dummyserver tests in koji.  They fail there in real builds, but not

# in scratch builds (weird).

rm -rf test/with_dummyserver/

%patch0 -p1

%patch1 -p1

%patch2 -p1

%patch3 -p1

%patch4 -p1

%build

%py2_build

%if %{with python3}

%py3_build

%endif

%install

%py2_install

rm -rf %{buildroot}/%{python2_sitelib}/urllib3/packages/six.py*

rm -rf %{buildroot}/%{python2_sitelib}/urllib3/packages/ssl_match_hostname/

mkdir -p %{buildroot}/%{python2_sitelib}/urllib3/packages/

# ovirt composes remove *.py files, leaving only *.pyc files there; this means we have to symlink

#  six.py* to make sure urllib3.packages.six will be importable

for i in ../../six.py{,o,c}; do

  ln -s $i %{buildroot}/%{python2_sitelib}/urllib3/packages/

done

ln -s ../../backports/ssl_match_hostname %{buildroot}/%{python2_sitelib}/urllib3/packages/ssl_match_hostname

# dummyserver is part of the unittest framework

rm -rf %{buildroot}%{python2_sitelib}/dummyserver

%if %{with python3}

%py3_install

# dummyserver is part of the unittest framework

rm -rf %{buildroot}%{python3_sitelib}/dummyserver

%endif # with python3

%if %{with tests}

%check

nosetests-%{python2_version}

%if %{with python3}

nosetests-%{python3_version}

%endif # with python3

%endif # with tests

%files

%doc CHANGES.rst README.rst CONTRIBUTORS.txt

%license LICENSE.txt

%{python2_sitelib}/urllib3*

%if %{with python3}

%files -n python3-%{srcname}

%doc CHANGES.rst README.rst CONTRIBUTORS.txt

%license LICENSE.txt

%{python3_sitelib}/urllib3*

%endif # with python3

%changelog

* Fri May 03 2019 Miro Hrončok <mhroncok@redhat.com> - 1.10.2-7

- Provide python2-urllib3

- Add patch for CVE-2019-11236

Resolves: rhbz#1703360

* Mon Mar 04 2019 Lumír Balhar <lbalhar@redhat.com> - 1.10.2-6

- Source URL switched to HTTPS protocol

- Add patch for CVE-2018-20060

Resolves: rhbz#1658471

* Wed Oct 11 2017 Iryna Shcherbina <ishcherb@redhat.com> - 1.10.2-5

- Add patch to support IP address SAN fields.

Resolves: rhbz#1434114

* Thu Sep 14 2017 Charalampos Stratakis <cstratak@redhat.com> - 1.10.2-4

- Update patch to find ca_certs in the correct location.

Resolves: rhbz#1450213

* Mon Jan 23 2017 Iryna Shcherbina <ishcherb@redhat.com> - 1.10.2-3

- Fix PoolManager instance to take into account new SSL configuration

Resolves: rhbz#1329395

* Mon Jul 27 2015 bkabrda <bkabrda@redhat.com> - 1.10.2-2

- Fix the way we unbundle six to make ovirt work even when they remove .py files

Resolves: rhbz#1247093

* Mon Apr 13 2015 Matej Stuchlik <mstuchli@redhat.com> - 1.10.2-1

- Update to 1.10.2

Resolves: rhbz#1226901

* Fri Mar  1 2013 Toshio Kuratomi <toshio@fedoraproject.org> - 1.5-5

- Unbundling finished!

* Fri Mar 01 2013 Ralph Bean <rbean@redhat.com> - 1.5-4

- Upstream patch to fix Accept header when behind a proxy.

- Reorganize patch numbers to more clearly distinguish them.

* Wed Feb 27 2013 Ralph Bean <rbean@redhat.com> - 1.5-3

- Renamed patches to python-urllib3-*

- Fixed ssl check patch to use the correct cert path for Fedora.

- Included dependency on ca-certificates

- Cosmetic indentation changes to the .spec file.

* Tue Feb  5 2013 Toshio Kuratomi <toshio@fedoraproject.org> - 1.5-2

- python3-tornado BR and run all unittests on python3

* Mon Feb 04 2013 Toshio Kuratomi <toshio@fedoraproject.org> 1.5-1

- Initial fedora build.